formbook | bd72f09ed9f35ab1327aef7ca8f0fc9ed6f696a0ec120e5ab4eca3ca32fa74b9

General

Target

4UWmsYiIC0tdIFk.exe
Size

639KB
MD5

c53f831c0cfef4921d4236c6435a0481
SHA1

961318099fa7615e9cf70cd87508df982cb13d97
SHA256

4c60c35f29e69092f5e26e18d43f332f00f33be5006dfb0f9e8cc7327ec6db92
SHA512

c4b45588aa914d3f11c1c9b5225bf9f47fb41dc06cc6572fc9e7666d74b60d4b9a0160c1f46fbd9841ce493b6ed1e8a864ae4459da9397ac8d2908dc98c20fbf
SSDEEP

12288:10KoFwl0ECedQwZTAO8zfkWdebsqC5oAawLOfk5ukR:+KoU0ECepZcOl9sqCZabfs

Score

10^/10

formbook ns03 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ns03

Decoy

dipity.tech

agathis.fun

ekaterinai.store

elizabethsbookshelf.com

smilesustainably.com

tapeworm.xyz

beatricesswarthout.xyz

nsrpackersandpackers.in

yedxec.xyz

gildedbeautyaesthitics.com

hanibalbechar.com

fichaphuman.net

adilosk.shop

geezaran.com

ventasemail.com

phonecasesdirect.store

rctjuc.shop

sukimossmanagement.com

caller-id.today

kft07.vip

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2692-13-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2692-17-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/2252-25-0x0000000000110000-0x000000000013F000-memory.dmp	formbook
behavioral1/memory/2252-27-0x0000000000110000-0x000000000013F000-memory.dmp	formbook

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2616 cmd.exe

pid	process
2616	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

4UWmsYiIC0tdIFk.exe4UWmsYiIC0tdIFk.exerundll32.exe

description	pid	process	target process
PID 2968 set thread context of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2692 set thread context of 1244	2692	4UWmsYiIC0tdIFk.exe	Explorer.EXE
PID 2252 set thread context of 1244	2252	rundll32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

4UWmsYiIC0tdIFk.exe4UWmsYiIC0tdIFk.exerundll32.exe

pid	process
2968	4UWmsYiIC0tdIFk.exe
2968	4UWmsYiIC0tdIFk.exe
2692	4UWmsYiIC0tdIFk.exe
2692	4UWmsYiIC0tdIFk.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

4UWmsYiIC0tdIFk.exerundll32.exe

pid process

2692 4UWmsYiIC0tdIFk.exe
2692 4UWmsYiIC0tdIFk.exe
2692 4UWmsYiIC0tdIFk.exe
2252 rundll32.exe
2252 rundll32.exe

pid	process
2692	4UWmsYiIC0tdIFk.exe
2692	4UWmsYiIC0tdIFk.exe
2692	4UWmsYiIC0tdIFk.exe
2252	rundll32.exe
2252	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4UWmsYiIC0tdIFk.exe4UWmsYiIC0tdIFk.exerundll32.exe

description	pid	process
Token: SeDebugPrivilege	2968	4UWmsYiIC0tdIFk.exe
Token: SeDebugPrivilege	2692	4UWmsYiIC0tdIFk.exe
Token: SeDebugPrivilege	2252	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

4UWmsYiIC0tdIFk.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 2968 wrote to memory of 1224	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 1224	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 1224	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 1224	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2676	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2676	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2676	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2676	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 2968 wrote to memory of 2692	2968	4UWmsYiIC0tdIFk.exe	4UWmsYiIC0tdIFk.exe
PID 1244 wrote to memory of 2252	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 2252	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 2252	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 2252	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 2252	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 2252	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 2252	1244	Explorer.EXE	rundll32.exe
PID 2252 wrote to memory of 2616	2252	rundll32.exe	cmd.exe
PID 2252 wrote to memory of 2616	2252	rundll32.exe	cmd.exe
PID 2252 wrote to memory of 2616	2252	rundll32.exe	cmd.exe
PID 2252 wrote to memory of 2616	2252	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe
"C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968

C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe
"C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
3⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe
"C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
3⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe
"C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\4UWmsYiIC0tdIFk.exe"
3⤵
- Deletes itself
PID:2616

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-19-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/1244-31-0x0000000004BE0000-0x0000000004CB5000-memory.dmp

Filesize
852KB

Download
memory/1244-20-0x0000000004BE0000-0x0000000004CB5000-memory.dmp

Filesize
852KB

Download
memory/2252-29-0x00000000009E0000-0x0000000000A73000-memory.dmp

Filesize
588KB

Download
memory/2252-27-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/2252-26-0x00000000020D0000-0x00000000023D3000-memory.dmp

Filesize
3.0MB

Download
memory/2252-25-0x0000000000110000-0x000000000013F000-memory.dmp

Filesize
188KB

Download
memory/2252-24-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/2252-22-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/2252-21-0x0000000000210000-0x000000000021E000-memory.dmp

Filesize
56KB

Download
memory/2692-15-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/2692-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-18-0x0000000000230000-0x0000000000244000-memory.dmp

Filesize
80KB

Download
memory/2692-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2968-14-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/2968-0-0x00000000000E0000-0x0000000000182000-memory.dmp

Filesize
648KB

Download
memory/2968-6-0x00000000053B0000-0x0000000005426000-memory.dmp

Filesize
472KB

Download
memory/2968-5-0x0000000001D60000-0x0000000001D6C000-memory.dmp

Filesize
48KB

Download
memory/2968-4-0x0000000001D50000-0x0000000001D58000-memory.dmp

Filesize
32KB

Download
memory/2968-3-0x0000000000750000-0x0000000000766000-memory.dmp

Filesize
88KB

Download
memory/2968-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2968-1-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads